Unauthorized Media Library File Deletion in Photo Reviews for WooCommerce by WordPress

CVE-2026-110251

What is CVE-2026-110251?

The Photo Reviews for WooCommerce plugin for WordPress has a vulnerability that allows unauthorized deletion of media library files. This issue arises from the delete_reviews_image() function, which improperly trusts attachment IDs provided via the wcpr_image_upload_id POST parameter. Attackers can exploit this flaw by inserting arbitrary attachment IDs into review comments, enabling them to permanently delete files associated with those IDs without any authentication requirements. The nonce used in the process is a publicly shared value, further simplifying exploitation. As a result, unauthenticated individuals can remove any media files in a WordPress installation, jeopardizing site integrity.

References